Siyuan-note - Siyuan - CRITICAL - CVE-2026-73056. The SiYuan kernel versions prior to 3.7.4 are affected by a vulnerability in the CheckAuth() middleware that allows unauthorized users to exploit the lack of a CAPTCHA or lockout mechanism when authenticating via an API token. This flaw permits an unauthenticated remote attacker to carry out unlimited automated attempts to guess the API token, leading to potential administrative access, arbitrary file operations, and SQL query executions if successful, particularly with weak or short tokens.